PT-2023-8931 · Php+1 · Php+1
Tvdijen
·
Published
2023-11-27
·
Updated
2023-12-06
·
CVE-2023-49087
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
simplesamlphp/xml-security versions prior to 1.6.12
simplesamlphp/xml-security versions prior to 5.0.0-alpha.13
Description
The issue is related to insufficient validation of XML signatures, which could allow a remote attacker to forge SAML messages by manipulating the
DigestValue. The vulnerability is due to the difference in validation between the canonicalized and non-canonicalized versions of the SignedInfo-tree. The attacker would need to exploit a bug in PHP's canonicalization function to manipulate the DigestValue.Recommendations
For versions prior to 1.6.12, update to version 1.6.12 or later.
For versions prior to 5.0.0-alpha.13, update to version 5.0.0-alpha.13 or later.
As a temporary workaround, consider restricting the use of the
validateReference method in SignedElementTrait until a patch is available.
Avoid using the DigestValue parameter in the affected XML signature validation until the issue is resolved.Exploit
Fix
Insufficient Verification of Data Authenticity
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Php
Simplesamlphp/Xml-Security